SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefWednesday, October 21, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
| THREAT OF THE DAY FortiSIEM RCE, PHP Emergency Patches, CA Compromise | CRITICAL |
| 5 C2 IPs | 147 OTX IOCs | 34 ARTICLES |
| ■ ANALYST TLDR Today's intelligence highlights critical vulnerabilities requiring immediate attention, including an unauthenticated RCE in FortiSIEM with a public PoC, upcoming emergency patches for PHP, and widespread revocation of compromised eMudhra CA certificates. Ransomware groups like Qilin and INC are actively exploiting a Palo Alto Networks flaw to bypass MFA, while supply chain attacks continue with AOMEI Backupper delivering backdoors. Additionally, AI agents are being leveraged by threat actors for automated website breaches, signaling an evolving attack landscape. |
| ■ CRITICAL STORIES CRITICAL | Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution A public Proof-of-Concept (PoC) exploit is now available for CVE-2026-106173, a critical RCE flaw in Fortinet FortiSIEM, demanding immediate patching. |
CRITICAL | PHP warns admins of two critical flaws, emergency patches coming tomorrow PHP is releasing emergency patches for two critical, undisclosed vulnerabilities, with information reportedly leaked, necessitating urgent preparation for updates. |
CRITICAL | Mozilla, Google, Apple block compromised eMudhra CA certificates / Go Issues Emergency Update Blocking Eight CA Keys Eight eMudhra intermediate CA certificates have been compromised due to weak private keys, allowing forgeries, leading to emergency blocks by major browsers and Go runtime. |
HIGH | Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA Ransomware groups are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access to bypass multi-factor authentication, posing a significant threat to network security. |
| ■ CVEs IDENTIFIED CVE-2026-106173 Fortinet FortiSIEM — Unauthenticated Remote Code Execution (RCE) |
CVE-2026-0257 Palo Alto Networks PAN-OS, Prisma Access — Authentication bypass (MFA bypass) |
[CVE-TBD] PHP — Undisclosed critical vulnerabilities (potential RCE/PE) |
[CVE-TBD] eMudhra CA certificates — Forged trusted certificates, MITM |
|
■ THREAT ACTORS SafePay ransomware gang | Ransomware |
Targeting businesses and critical infrastructure, using password guessing, vulnerability exploitation, and phishing. |
Qilin ransomware group | Ransomware |
Exploiting Palo Alto Networks flaw (CVE-2026-0257) to bypass MFA. |
INC ransomware group | Ransomware |
Exploiting Palo Alto Networks flaw (CVE-2026-0257) to bypass MFA. |
|
|
| ■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | FortiSIEM RCE, Palo Alto Networks MFA bypass, SafePay exploiting vulnerabilities, AI agents breaching websites. |
| T1078.003 | | Account Access: Stolen Credentials | UpdraftCentral keys, Zeabur leaked credentials. |
| T1552.004 | | Credentials from Password Stores: Private Keys | eMudhra CA key compromise. |
| T1566 | | Phishing | SafePay ransomware, Nigerian national's tax business hacks (spearphishing). |
| T1110 | | Brute Force | SafePay ransomware (guessing passwords). |
| T1556 | | Bypass Multi-Factor Authentication | Qilin/INC ransomware exploiting Palo Alto Networks flaw. |
|
■ PATCH PRIORITY CRITICAL | Fortinet FortiSIEM (CVE-2026-106173) — Unauthenticated RCE with public PoC — THN |
CRITICAL | PHP — Emergency patches for critical flaws (potential RCE/PE) — BC |
CRITICAL | eMudhra CA certificates, Mozilla Firefox, Google Chrome, Apple Safari/OS, Go runtime — Compromised CA certificates, potential for forged trust — THN/BC |
CRITICAL | AOMEI Backupper — Supply chain compromise, backdoor delivery — SW |
|
|
| ■ RECOMMENDED ACTIONS TODAY | 1 | P1 | Patch Fortinet FortiSIEM immediately for CVE-2026-106173 due to the public RCE PoC. |
| 2 | P1 | Prepare to apply emergency patches for PHP as soon as they are released tomorrow to address critical vulnerabilities. |
| 3 | P1 | Update Go runtime to versions 1.27.3 or 1.26.10 and ensure browsers (Mozilla Firefox, Google Chrome, Apple Safari) are updated to block compromised eMudhra CA keys. |
| 4 | P2 | Patch Palo Alto Networks PAN-OS and Prisma Access for CVE-2026-0257 to prevent MFA bypass by ransomware groups. |
| 5 | P2 | Audit AOMEI Backupper installations for signs of the ShinyRoad modular backdoor framework and ensure software integrity. |
|
| | C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
| FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
| IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |
|